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By Hand Delivery 
Daniel Crane, Director 

Office of Consumer Affairs and Business Regulation 
Ten Park Plaza, Suite 5170 
Boston, Massachusetts 02116 

Dear Director Crane: 



I am writing to notify you of a recent incident affecting a Harvard Law School 
(“HLS”) clinical program, the Legal Services Center (“LSC”). LSC is one of HLS’s 
largest clinical programs; under the supervision of clinical instructors, HLS students 
provide or are contacted for legal services by more than 1,000 persons annually. 

A back-up tape used in connection with the LSC case management system has 
been lost. The back-up tape contained client information recorded over a number of 
years by LSC attorneys and students, including names, contact information, Social 
Security numbers, financial information, and other personal information. 

We can last account for the lost tape on September 23, 2008, when it and five 
other tapes were picked-up at LSC’s offices in Jamaica Plain by a HLS information 
technology technician. Once we became aware on October 22 that the tape was missing, 
a thorough but unsuccessful search was conducted. Appropriate remedial measures are 
underway. To prevent future incidents of this kind, the University has encrypted the LSC 
servers and backup tapes, purchased a new tape library for LSC with a barcode reader for 
better inventorying, and hired Iron Mountain to provide a more secure pick-up process 
for the back-up tapes. The University is also conducting a review of LSC’s security 
needs generally. 

The back-up tape was password-protected and cannot be read without specialized 
skills and equipment. There are no marks on the tape that indicate the type of 
information stored on it. We also have no reason to believe that any unauthorized person 
accessed or used any of the personal information contained in the folders. Although for 
that reason the incident does not appear to be subject to M.G.L. c. 93H, we have 
nevertheless decided to notify the affected persons. 
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The missing tape contained “personal information” (within the meaning of the 
statute) of 8,311 individuals. We have not been able to definitively determine the legal 
residence of each of the individuals, but we think it is safe to assume that most are 
Massachusetts residents. We have contact information for 7,718 of these individuals and 
will notify them of the loss of the tape by a letter (in both English and Spanish) dated 
November 4, 2008 (the “93H Notification Letter”). To reach the 593 people for whom 
we do not have contact information, we will post notices in the Boston Globe, Boston 
Herald, and La Semana (in Spanish), and on the LSC website 

(http://www.law.harvard.edu/academics/clinical/lsc). The 93H Notification Letter and 
legal notice contain largely the same text. Both describe the loss of data and advise 
affected persons of precautionary steps they could take to protect themselves; both also 
include the other elements that Section 3(b) of Chapter 93H requires. 

In addition, Harvard is providing affected persons with a complimentary one 
year membership in Experian’s Triple Alert SM credit monitoring product at no cost to 
them. 


The missing tape also contained client data relating to up to 15,657 other 
individuals (there was no practical means of identifying all duplicates and test entries, 
though we know there were a number), but that data did not include “personal 
information.” Of those individuals, we have contact information for 13,116, to whom we 
will send another notification letter dated November 4, 2008 describing the loss of the 
tape and apologizing for the incident (the “Other Notification Letter”). 

Examples of both the 93H Notification Letter and Other Notification Letter (with 
addressees redacted) are attached. We are also notifying the Division of Consumer 
Protection of the Office of the Attorney General. 

If you have any questions, please call the undersigned. 
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SECURITY FREEZES 


Q. What is a security freeze? 

A security freeze is a notice placed on your credit report by a consumer reporting agency at your 
request. It prohibits the consumer reporting agency from releasing your report or any information 
in it without your express authorization. Since most businesses will not open credit accounts 
without first checking a consumer’s credit history, a security freeze may help to prevent credit, 
loans, or other services from being approved in your name without your explicit consent. Under 
Massachusetts law, Massachusetts residents have the right to request a security freeze. 

Q. How do I request a security freeze? 

To place a security freeze on your credit report, you must send a written request to each of the 
three major consumer reporting agencies by regular, certified or overnight mail at the addresses 
below: Experian (www.experian.com : 888-397-3742), Equifax (www.equifx.com : 888-766- 
0008), and TransUnion (www.transunion.com : 888-909-8872). If you request a security freeze, 
the consumer reporting agencies will inform you about the process of placing, removing, and 
lifting a security freeze. 

Experian, P.O. Box 9554, Allen, TX 75013 (overnight delivery also may be made to Experian, 
711 Experian Parkway, Allen, TX 75013) 

Equifax Security Freeze, P.O. Box 105788, Atlanta, GA 30348 

TransUnion, Fraud Victim Assistance Department, P.O. Box 6790, Fullerton, CA 92834 
(overnight mail may be sent to TransUnion, Fraud Victim Assistance Department, 1561 E. 
Orangethorpe Avenue, Fullerton, CA 92831) 

In order to request a security freeze, you will need to provide the following information: 

1. Your full name (including middle initial as well as Jr., Sr., II, III, etc.); 

2. Social Security Number; 

3. Date of birth; 

4. If you have moved in the past five (5) years, provide the addresses where you have lived 
over the prior five years; 

5. Proof of current address such as a current utility bill or telephone bill; 

6. A legible photocopy of a government issued identification card (state driver’s license or 
ID card, military identification, etc.) 

7. If you are a victim of identity theft, include a copy of either the police report, 
investigative report, or complaint to a law enforcement agency concerning identity theft; 

8. If you are not a victim of identity theft, include payment by check, money order, or credit 
card (Visa, MasterCard, American Express or Discover only). Do not send cash through 
the mail. 

To place a security freeze on your credit file at each of the 3 credit reporting agencies, you must 
contact each of them directly. The credit reporting agencies will not share your request with each 
other. 







A reporting agency will place a security freeze on your report within 3 business days after 
receiving your request. The consumer reporting agency will send you a written confirmation of 
the security freeze within 5 business days after receiving your request and provide you with a 
unique personal identification number (PIN) or password, or both that can be used by you to 
authorized the removal or lifting of the security freeze. 

Q. How long will a security freeze remain in place? 

A security freeze will remain in place until you request that it be lifted or removed. 

Q. How do I request that a security freeze be lifted or removed? 

To lift the security freeze in order to allow a specific entity or individual access to your credit 
report, you must call or send a written request to the credit reporting agencies by mail and include 
proper identification (name, address, and social security number) and the PIN number or 
password provided to you when you placed the security freeze as well as the identities of those 
entities or individuals you would like to receive your credit report or the specific period of time 
you want the credit report available. The credit reporting agencies have three (3) business days 
after receiving your request to lift the security freeze for those identified entities or for the 
specified period of time. 

To remove the security freeze, you must send a written request to each of the three credit bureaus 
by mail and include proper identification (name, address, and social security number) and the 
PIN number or password provided to you when you placed the security freeze. The credit bureaus 
have three (3) business days after receiving your request to remove the security freeze. Q. Is 

there a fee for placing, lifting, or removing a security freeze? 

A consumer reporting agency may charge you up to $5 for placing, lifting, or removing a freeze. 
Victims of identity theft and their spouses do not have to pay a fee if they have submitted a valid 
police report about the identity theft to the consumer reporting agency. 

Q. How is a security freeze different from a fraud alert? 

A security freeze is more restrictive than a fraud alert. The security freeze is designed to prevent 
credit, loans, or services from being approved in your name without your consent. You should be 
aware that using a security freeze may delay, interfere with, or prevent the timely approval of any 
subsequent request or application you make regarding new loans, credit, mortgage, insurance, 
government services or payments, rental housing, employment, investment, license, cellular 
phone, utilities, digital signature, internet credit card transactions, or other services, including an 
extension of credit at point of sale. You may temporarily lift a security freeze for a certain period 
of time or for a specific creditor. By comparison, a fraud alert does not block potential new credit 
but rather lets creditors know to contact you before opening a new account. 

Q. How can I obtain more information about security freezes? 

For more information about security freezes, please see the credit reporting agencies’ websites: 






- experian.com 

- equifax.com/ 

- transunion.com 

Q. Can I receive a copy of my credit report without requesting a security freeze or fraud 
alert? 

Yes. Every consumer, whether or not a victim of identity theft, may receive one free credit report 
every 12 months from each of the three national credit bureaus. Call 877-322-8228 or make a 
request online at www.annualcreditreport.com . 





Legal Services Center of Harvard Law School 
122 Boylston Street 
Jamaica Plain MA 02130 


November 4, 2008 
Dear LSC Client, 

In our effort to provide clients with the best possible service, the Harvard Law 
School Legal Services Center (“LSC”) has implemented an electronic records system. 
The system enables LSC students and supervising attorneys to organize case information 
and to track the progression of cases. To ensure that case information is not lost in the 
event of a power failure or other system issue, Harvard Law School (“HLS”) has 
implemented a protocol for backing-up the data. 

HLS recently discovered that one of the tapes used to back-up the LSC case 
management system is missing. The tape was last seen on September 23, 2008. Since 
discovering its absence, HLS has conducted an exhaustive search, but has not been able 
to account for the tape. The missing tape contains a variety of client data, including 
names, Social Security numbers, contact information, financial information, and other 
personal information. The missing tape is password-protected, however, and cannot be 
read without specialized skills and equipment. There are also no marks on the tape that 
indicate the type of information stored on it. Nevertheless, because of the sensitive 
nature of the data on the tape, we believe it is important to inform you of its loss. 

To this point, there has been no indication that the tape has been acquired by an 
unauthorized person or that the data has been accessed. However, because HLS has not 
yet located the tape, we cannot rule out that possibility. We therefore recommend that 
you remain alert for possible fraud and identity , theft by reviewing and monitoring your 
credit and financial account information for unauthorized activity. Under state law, you 
may order a “security freeze” on your credit reports as a further precaution. A security 
freeze prohibits a credit reporting company from releasing any information from a 
consumer’s credit report without written authorization. However, please be aware that 
placing a security freeze on your credit report may delay, interfere with, or prevent the 
timely approval of any requests you make for new loans, credit mortgages, employment, 
housing or other services. If you are a legal resident of Massachusetts, instructions for 
Massachusetts residents on how to place a freeze are attached (“Security Freezes”). For 
legal residents of other states, we believe that the process is similar. We will work with 
anyone who has questions about these steps and will reimburse the fees, if any, for 
placing a security freeze. We have also set up a special phone number at LSC to answer 
questions. The number is 617-390-2566. 






In addition, to help you detect the possible misuse of your personal information, 
we are providing you with a complimentary one year membership in Triple Alert credit 
monitoring at no cost to you. Triple Alert SM will be provided by ConsumerInfo.com, 
Inc., an Experian® company. This product will monitor your credit reports at the three 
national credit reporting companies: Experian, Equifax® and TransUnion® and notify you 
of key changes. Your Triple Alert SM membership is completely free and will not hurt 
your credit score. You have ninety (90) days from the date of this letter to activate this 
membership, which will then continue for 12 full months. 

The web site to enroll in Triple Alert and your individual activation code are both 
listed below. To sign up, please visit the web site and enter your individual activation 
code. Please keep in mind that once activated, the code cannot be re-used for another 
enrollment. The web site will guide you through the process of enrolling in Triple Alert. 
If you need technical assistance, please call 866-252-0121. 

Triple Alert Web Site: 

Your Activation Code: .. 

If you wish to enroll over the phone for delivery of your membership via US mail, 
please call 866-252-0121. 

If you would like any additional general information on protecting yourself 
against fraud, visit the website of the Federal Trade Commission at www.ftc.gov or 
calling the FTC's Identity Theft Hotline toll-free number at 1-877-IDTHEFT (1-877-438- 
4338). 


You have the right to obtain a copy of the police report relating to this event. A 
police report concerning this matter is on file with the Harvard University Police 
Department, but can only be released to affected persons. You may obtain a copy from 
HUPD by e-mailing your request to steven catalano@hai-yard.edu or mailing your 
request to Steven Catalano, Assistant Director for Strategic Planning and Analysis, 
Harvard University Police Department, 1033 Massachusetts Avenue, 6th floor, 
Cambridge, Massachusetts 02138. 

We are truly sorry for the inconvenience and concern this event may cause. 
Please be assured that we are taking steps internally in an effort to prevent future 
incidents of this kind. We will let you know if we obtain any additional information 
suggesting that your personal information has in fact been compromised. 

Yours truly, 

Brian K. Price 
Director 






Legal Services Center of Harvard Law School 
122 Boylston Street 
Jamaica Plain MA 02130 


November 4, 2008 

Dear LSC Clients and Interested Persons, 

In our effort to provide clients with the best possible service, the Harvard Law 
School Legal Services Center (“LSC”) has implemented an electronic records system. 

The system enables LSC students and supervising attorneys to organize case information 
and to track the progression of cases. To ensure that case information is not lost in the 
event of a power failure or other system issue, Harvard Law School (“HLS”) has 
implemented a protocol for backing-up the data. 

HLS recently discovered that one of the tapes used to back-up the LSC case 
management system is missing. The tape was last seen on September 23, 2008. Since 
discovering its absence, HLS has conducted an exhaustive search, but has not been able 
to account for the tape. The missing tape contains a variety of client data, including 
names, contact information, and other personal and case-related information, but does not 
include your social security number or financial account information. 

The missing tape is password-protected and cannot be read without specialized 
skills and equipment. There are also no marks on the tape that indicate the type of 
information stored on it. To this point, there has been no indication that the tape has been 
acquired by an unauthorized person or that the data has been accessed. However, 
because HLS has not yet located the tape, we cannot rule out that possibility. In addition, 
given the sensitive nature of the data on the tape, we believe it is important to inform you 
of its loss 

We are truly sorry for the inconvenience and concern this event may cause. 

Please be assured that we are taking steps internally in an effort to prevent future 
incidents of this kind. We will let you know if we obtain any additional information 
suggesting that your personal information has in fact been compromised. 

Yours truly, 

Brian K. Price 
Director 




